Last modified: 2010-07-01 19:55:25 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T26022, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 24022 - upload.js doesn't respect $wgStrictFileExtensions
upload.js doesn't respect $wgStrictFileExtensions
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
Uploading (Other open bugs)
1.17.x
All All
: Normal minor (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-06-18 00:59 UTC by Jack Bates
Modified: 2010-07-01 19:55 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Jack Bates 2010-06-18 00:59:34 UTC
Previously, by disabling $wgStrictFileExtensions, I could upload files with extensions that are not among the "preferred extensions"

Since upgrading MediaWiki, I can no longer upload files with extensions that are not among the "preferred extensions"

upload.js, roughly line 245, refuses to upload these files - even if $wgStrictFileExtensions is disabled
Comment 1 Derk-Jan Hartman 2010-06-18 13:53:11 UTC
We could easily fix this by exposing wgStrictFileExtensions on the upload page, but that doesn't seem like a good idea to me. Someone might go around looking for mediawiki sites where he can upload arbitrary files.

Wouldn't it be best if we retooled all this into a single ajax call ?

one that checks for:
-name exists
-name allowed (file extensions checks)
-name normalization (think $wgCapitalizedNamespaces)
Comment 2 Bryan Tong Minh 2010-06-18 13:57:04 UTC
(In reply to comment #1)
> We could easily fix this by exposing wgStrictFileExtensions on the upload page,
> but that doesn't seem like a good idea to me. Someone might go around looking
> for mediawiki sites where he can upload arbitrary files.
> 
I don't think it is that much of a problem; you could also try it out by uploading a file.

> Wouldn't it be best if we retooled all this into a single ajax call ?
> 
> one that checks for:
> -name exists
> -name allowed (file extensions checks)
> -name normalization (think $wgCapitalizedNamespaces)

If somebody would implement that, yes, that would be ideal. But for now exposing wgStrictFileExtensions could be used as quick fix.
Comment 3 Derk-Jan Hartman 2010-07-01 19:55:25 UTC
Fixed in r68848

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links